CISSP:

Certified Information

Systems Security Professional

Study Guide

2nd Edition

Associate Publisher: Neil Edde

Acquisitions and Developmental Editor: Heather O’Connor

Production Editor: Lori Newman

Technical Editor: Patrick Bass

Copyeditor: Judy Flynn

Compositor: Craig Woods, Happenstance Type-O-Rama

Graphic Illustrator: Happenstance Type-O-Rama

CD Coordinator: Dan Mummert

CD Technician: Kevin Ly

Proofreaders: Laurie O’Connell, Nancy Riddiough

Indexer: Ted Laux

Book Designer: Bill Gibson, Judy Fung

Cover Designer: Archer Design

Cover Photographer: Victor Arre, Photodisc

Copyright © 2004 SYBEX Inc., 1151 Marina Village Parkway, Alameda, CA 94501. World rights reserved. No part of this publication may be stored in a retrieval system, transmitted, or reproduced in any way, including but not limited to photocopy, photograph, magnetic, or other record, without the prior agreement and written permission of the publisher.

First edition copyright © 2003 SYBEX Inc.

Library of Congress Card Number: 2003115091

ISBN: 0-7821-4335-0

SYBEX and the SYBEX logo are either registered trademarks or trademarks of SYBEX Inc. in the United States and/or other countries.

Screen reproductions produced with FullShot 99. FullShot 99 © 1991–1999 Inbit Incorporated. All rights reserved.

FullShot is a trademark of Inbit Incorporated.

The CD interface was created using Macromedia Director, COPYRIGHT 1994, 1997–1999 Macromedia Inc. For more information on Macromedia and Macromedia Director, visit http://www.macromedia.com.

This study guide and/or material is not sponsored by, endorsed by or affiliated with International Information Systems Security Certification Consortium, Inc. (ISC)2® and CISSP® are registered service and/or trademarks of the International Information Systems Security Certification Consortium, Inc. All other trademarks are the property of their respective owners.

TRADEMARKS: SYBEX has attempted throughout this book to distinguish proprietary trademarks from descriptive terms by following the capitalization style used by the manufacturer.

The author and publisher have made their best efforts to prepare this book, and the content is based upon final release software whenever possible. Portions of the manuscript may be based upon pre-release versions supplied by software manufacturer(s). The author and the publisher make no representation or warranties of any kind with regard to the completeness or accuracy of the contents herein and accept no liability of any kind including but not limited to performance, merchantability, fitness for any particular purpose, or any losses or damages of any kind caused or alleged to be caused directly or indirectly from this book.

Manufactured in the United States of America

10 9 8 7 6 5 4 3 2 1

To Our Valued Readers:

Thank you for looking to Sybex for your CISSP exam prep needs. We at Sybex are proud of our reputation for providing certification candidates with the practical knowledge and skills needed to succeed in the highly competitive IT marketplace. Certification candidates have come to rely on Sybex for accurate and accessible instruction on today’s crucial technologies. For the second year in a row, readers such as you voted Sybex as winner of the “Best Study Guides” category in the 2003 CertCities Readers Choice Awards.

The author and editors have worked hard to ensure that the new edition of the CISSP®: Certified Information Systems Security Professional Study Guide you hold in your hands is comprehensive, in-depth, and pedagogically sound. We’re confident that this book will exceed the demanding standards of the certification marketplace and help you, the CISSP certification candidate, succeed in your endeavors.

As always, your feedback is important to us. If you believe you’ve identified an error in the book, please send a detailed e-mail to support@sybex.com. And if you have general comments or suggestions, feel free to drop me a line directly at nedde@sybex.com. At Sybex we’re continually striving to meet the needs of individuals preparing for certification exams.

Good luck in pursuit of your CISSP certification!

Neil Edde

Associate Publisher—Certification

Sybex, Inc.

Acknowledgments

Thanks to Neil Edde and Jordan Gold at Sybex for helping us hook up with this project; thanks also to Rodnay Zaks for numerous fine gastronomic experiences and for an even greater number of good ideas. But Neil wins the “great gastronomy prize” for taking me to Chez Panisse for lunch the last time I visited Sybex’s Alameda offices. Thanks to my mom and dad for providing me with the basic tools to become a writer and trainer: an inquiring mind, plus good verbal and debating skills. Thanks to Dina Kutueva, not just for marrying me and completing my life, but also for her magnificent efforts and sacrifices in delivering our beautiful son, Gregory E. Tittel, in February 2004. You rule my world! And finally, thanks to the whole historical LANWrights gang—Dawn, Mary, Kim, Bill, Chelsea, Natanya, and Michael—for 10 great years of camaraderie, collaboration, and the occasional success. You guys are the greatest; I couldn’t have done it without you! I'm sorry we haven't all been able to stay together, but I'll always value our time together and our continuing friendships.

—Ed Tittel

Thanks to Ed Tittel and LANWrights, Inc. for allowing me to contribute to the revision of this book. Working with you guys is and always has been a pleasure. Thanks to my editor Dawn Rader for putting up with my bad grammar. Thanks to my third co-author, Mike Chapple, for helping make this book all it could be. To my parents, Dave and Sue, thanks for your love and consistent support. To my sister Sharon and nephew Wesley, it’s great having family like you to spend time with. To Mark, it’s time we bolth got a life. To HERbert and Quin, it’s great having two furry friends around the house. And finally, as always, to Elvis—where did you get that shiny gold suit? I want to wear it around town to blind anyone who gazes in my direction.

—James Michael Stewart

I’d like to thank Ed Tittel, Dawn Rader, and the team at LANWrights, Inc. for their assistance with this project. I also owe a debt of gratitude to the countless technical experts in government and industry who’ve patiently answered my questions and fueled my passion for security over the years. Above all, I’d like to thank my wife Renee for her undying patience as I worked on this book. Without her support, this never would have been possible.

—Mike Chapple

Contents at a Glance

Contents